Bug 2187257 (CVE-2023-1998)

Summary:	CVE-2023-1998 kernel: Spectre v2 SMT mitigations problem
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, dareynol, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kyoshida, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rcheerla, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, swood, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, zmiele
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.3	Doc Type:	If docs needed, set a value
Doc Text:	It was found that the Linux Kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes running on the same physical core in another hyperthread.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-01 17:02:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2187266, 2187267, 2187268, 2187269, 2214849, 2215056, 2187260, 2215014, 2215108
Bug Blocks:	2187222

Description Mauro Matteo Cascella 2023-04-17 09:19:55 UTC

The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp [..] The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes running on the same physical core in another hyperthread.

Reference:
https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx

Upstream fix:
https://github.com/torvalds/linux/commit/6921ed9049bc7457f66c1596c5b78aec0dae4a9d

Comment 1 Mauro Matteo Cascella 2023-04-17 09:30:29 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2187260]

Comment 6 Justin M. Forbes 2023-04-19 11:48:09 UTC

This was fixed for Fedora with the 6.1.16 stable kernel updates.

Comment 16 errata-xmlrpc 2023-08-01 08:59:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4378 https://access.redhat.com/errata/RHSA-2023:4378

Comment 17 errata-xmlrpc 2023-08-01 09:17:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4377 https://access.redhat.com/errata/RHSA-2023:4377

Comment 18 Product Security DevOps Team 2023-08-01 17:02:29 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1998